Software inventory: Add Adobe plugins

[noahtalerman]

Goal

User story
As a Fleet user on the Software page,
I want to see Adobe plugins
so that I can understand which plugins are installed in my fleet, and search for known vulnerable plugins.

Changes

Product

• UI changes: Figma
• CLI (fleetctl) usage changes: No changes
• YAML changes: No changes
• REST API changes: No changes
• Fleet's agent (fleetd) changes: No changes
• Fleet server configuration changes: No changes
• Exposed, public API endpoint changes: No changes
• fleetdm.com changes: No changes
• GitOps mode UI changes: No changes
• GitOps generation changes: No changes
• Activity changes: No changes
• Permissions changes: No changes
• Changes to paid features or tiers: Fleet Free
• My device and fleetdm.com/better changes: No changes
• Usage statistics: No changes
• Other reference documentation changes: No changes
• First draft of test plan added
• Once shipped, requester has been notified
• Once shipped, dogfooding issue has been filed

Engineering

Sub-tasks:

• Adobe plugins: software inventory ingestion (detail query, source handling, osquery-perf) #49060 — Adobe plugins: software inventory ingestion (detail query, source handling, osquery-perf)

• Adobe plugins: exclude from vulnerability scanning #49061 — Adobe plugins: keep vulnerability column live + false-positive guardrail

• Adobe plugins: "Plugin (Adobe)" type display name + Adobe icon #49062 — Adobe plugins: "Plugin (Adobe)" type display name + Adobe icon

• Adobe plugins: documentation (host vitals query reference) #49063 — Adobe plugins: documentation (host vitals query reference)

• Adobe plugins: engineering QA on real devices (macOS + Windows) #49064 — Adobe plugins: engineering QA on real devices (macOS + Windows)

• Spike: investigate vulnerability data sources for Adobe plugins (CEP/UXP extensions) #49056 — Spike: investigate vulnerability data sources for Adobe plugins (CEP/UXP extensions)

• Test plan is finalized

• Contributor API changes: No changes. Adobe plugins reuse the existing software titles/versions/host-software endpoints and response shapes; no new or modified REST API.

• Feature guide changes: No new guide. The host vitals reference (docs/Contributing/reference/understanding-host-vitals.md) is updated to document the new software_adobe_plugins query (sub-task Adobe plugins: documentation (host vitals query reference) #49063).

• Database schema migrations: No changes. software.source is a free-text varchar(64) column; a new source value produces distinct software rows/titles without a migration.

• Load testing: No dedicated load test required. This adds one read-only software source following the existing vscode_extensions / jetbrains_plugins pattern.

• Pre-QA load test: Not required — the change does not measurably modify Fleet's load profile.

• Load testing/osquery-perf improvements: Yes — cmd/osquery-perf is updated to emit synthetic adobe_plugins software so load tests and QA environments are realistic (part of sub-task Adobe plugins: software inventory ingestion (detail query, source handling, osquery-perf) #49060).

• This is a premium only feature: No — Fleet Free. Software inventory and vulnerabilities are core features.

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

Risk assessment

• Requires testing on real macOS and Windows devices with Adobe Creative Cloud and CEP/UXP extensions installed (sub-task Adobe plugins: engineering QA on real devices (macOS + Windows) #49064).
• Risk level: Low
  • Adds one read-only software source via the established vscode_extensions / jetbrains_plugins pattern. No schema change, no new endpoints, no premium gating. The query only runs on hosts whose fleetd ships the adobe_plugins table (discovery-gated), so older agents are unaffected.

Test plan

Make sure to go through the list and consider all events that might be related to this story, so we catch edge cases earlier.

Core flow

• On a macOS host running fleetd ≥ v1.56.0 with Adobe Creative Cloud and at least one CEP and one UXP extension installed, open the Software page and confirm each extension appears as a distinct software title with Type "Plugin (Adobe)", the Adobe-plugin icon, the correct version, and an accurate host count.
• Repeat on a Windows host with the same setup and confirm the same results.
• Open a host's Details → Software and confirm the Adobe plugins appear with Type "Plugin (Adobe)" and the correct installed path(s).
• Confirm the Vulnerabilities column is live for Adobe plugins (shows a count, or 0 — not "Not supported") and shows no false-positive Adobe host-app CVEs.

UI

• Verify that all UI changes specified in the Figma wireframes are correctly implemented
• Verify expected UI states (loading, empty, error states if applicable)
• Verify Type shows "Plugin (Adobe)", the new Adobe-plugin icon renders in the Name cell, and the Vulnerabilities column renders (not "Not supported")

API

No API changes for this story. Adobe plugins reuse the existing software titles/versions/host-software endpoints and response shapes, so there are no new or modified endpoints to test.

GitOps (generate + run)

Not applicable. Adobe plugins are read-only inventory; there are no GitOps-configurable settings for this feature.

Permissions

• Verify role restrictions are applied correctly for global roles — all roles that can view the Software page (admin, maintainer, observer, observer+) see Adobe plugins, matching the behavior of other software sources. Adobe plugins introduce no new permissions.
• Verify role restrictions are applied correctly for fleet-level roles

Edge cases

• Linux host: reports no Adobe plugins and logs no query errors (the query runs on macOS/Windows only).
• Host on fleetd older than v1.56.0 (no adobe_plugins table): the discovery query prevents execution; no errors are logged.
• macOS/Windows host with Adobe Creative Cloud but no installed plugins: shows no Adobe plugins.
• Same plugin installed for multiple users and/or system-wide: dedupes to a single software title with the correct host count and multiple installed paths.
• Extension with a missing or malformed manifest: appears with the directory name and an empty version; no crash or error.
• Extension whose name resembles an Adobe application (e.g. "Photoshop Helper"): does NOT get an Adobe host-app CVE mis-attributed to it (false-positive guardrail from sub-task Adobe plugins: exclude from vulnerability scanning #49061).

Supplemental testing

Testing notes

• Requires real macOS and Windows devices with Adobe Creative Cloud installed, plus at least one CEP extension and one UXP extension (e.g. installed from Adobe Exchange). Note each plugin's name, version, and vendor from its manifest to compare against Fleet's inventory.
• Hosts must run fleetd ≥ v1.56.0 (the release that ships the adobe_plugins osquery extension table).
• There is currently no vulnerability data source for Adobe extensions (see Spike: investigate vulnerability data sources for Adobe plugins (CEP/UXP extensions) #49056), so the Vulnerabilities column is expected to be live but typically empty; the key check is the absence of false positives.

Confirmation

1. Engineer: Added comment to user story confirming successful completion of test plan (include any special setup, test data, or configuration used during development/testing if applicable).
2. QA: Added comment to user story confirming successful completion of test plan.
3. QA: Determined whether this story needs Playwright automation.
   • Needs automation: Yes / No
   • If yes, filed a follow-up issue in the :help-qa project with status "Needs automation": TODO